@theihtisham/agent-shadow-brain 5.2.0 → 6.0.2

package/dist/brain/agent-firewall.d.ts

@@ -0,0 +1,7 @@
+import { FirewallCheckInput, FirewallDecision } from '../types.js';
+export declare class AgentFirewall {
+    check(input: FirewallCheckInput): FirewallDecision;
+    formatClaudeHookDecision(decision: FirewallDecision): string;
+    private excerpt;
+}
+//# sourceMappingURL=agent-firewall.d.ts.map

package/dist/brain/agent-firewall.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-firewall.d.ts","sourceRoot":"","sources":["../../src/brain/agent-firewall.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAmB,MAAM,aAAa,CAAC;AA8BpF,qBAAa,aAAa;IACxB,KAAK,CAAC,KAAK,EAAE,kBAAkB,GAAG,gBAAgB;IAmHlD,wBAAwB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM;IAW5D,OAAO,CAAC,OAAO;CAGhB"}

package/dist/brain/agent-firewall.js

@@ -0,0 +1,152 @@
+// src/brain/agent-firewall.ts — Local safety firewall for AI agent tool calls
+const SECRET_PATH = /(^|[/\\])(\.env(\.|$)|id_rsa|id_ed25519|\.npmrc|\.pypirc|\.netrc|credentials|secrets?)([/\\]|$)/i;
+const DESTRUCTIVE_COMMANDS = [
+    /\brm\s+-rf\s+(?:\/|\*|~|\$HOME|\.{1,2})(?:\s|$)/i,
+    /\bgit\s+reset\s+--hard\b/i,
+    /\bgit\s+clean\s+-fdx\b/i,
+    /\b(?:mkfs|diskpart|format)\b/i,
+    /\bdd\s+if=.*\s+of=\/dev\//i,
+    /\bchmod\s+-R\s+777\b/i,
+];
+const PACKAGE_RISKS = [
+    /\b(?:curl|wget)\b[^|;&]*(?:\||&&)\s*(?:sh|bash|zsh)\b/i,
+    /\bnpm\s+(?:install|i)\s+(?:-g\s+)?(?:https?:|git\+|github:)/i,
+    /\bpip\s+install\s+(?:https?:|git\+)/i,
+    /\b(?:npx|pnpm dlx|bunx)\s+[^;\n]*--yes\b/i,
+];
+const PROMPT_INJECTION = [
+    /ignore (?:all )?(?:previous|prior|system|developer) instructions/i,
+    /reveal (?:the )?(?:system prompt|developer message|hidden instructions)/i,
+    /exfiltrat(?:e|ion)|send (?:all )?(?:files|secrets|credentials)/i,
+    /disable (?:security|safety|guardrails|firewall)/i,
+];
+const SECRET_CONTENT = [
+    /(?:api[_-]?key|secret|token|password|passwd|pwd)\s*[:=]\s*["'][^"']{8,}["']/i,
+    /(?:api[_-]?key|secret|token|password|passwd|pwd)\s*[:=]\s*[A-Za-z0-9_\-./+=]{12,}/i,
+    /-----BEGIN (?:RSA |OPENSSH |EC |DSA )?PRIVATE KEY-----/i,
+    /Bearer\s+[A-Za-z0-9\-._~+/]+=*/i,
+];
+export class AgentFirewall {
+    check(input) {
+        const findings = [];
+        if (input.filePath && SECRET_PATH.test(input.filePath)) {
+            findings.push({
+                type: 'secret-access',
+                severity: 'critical',
+                blocked: true,
+                reason: 'Agent attempted to access a sensitive credential path.',
+                evidence: input.filePath,
+                recommendation: 'Use a redacted example file or explicitly approve the path for this session.',
+            });
+        }
+        if (input.command) {
+            for (const pattern of DESTRUCTIVE_COMMANDS) {
+                if (pattern.test(input.command)) {
+                    findings.push({
+                        type: 'destructive-command',
+                        severity: 'critical',
+                        blocked: true,
+                        reason: 'Command matches a destructive shell pattern.',
+                        evidence: input.command,
+                        recommendation: 'Use a scoped command, dry-run flag, or require explicit human approval.',
+                    });
+                    break;
+                }
+            }
+            for (const pattern of PACKAGE_RISKS) {
+                if (pattern.test(input.command)) {
+                    findings.push({
+                        type: 'package-risk',
+                        severity: 'high',
+                        blocked: true,
+                        reason: 'Command downloads or executes remote code without a pinned, reviewable artifact.',
+                        evidence: input.command,
+                        recommendation: 'Pin the package/version, inspect it first, and avoid curl-to-shell execution.',
+                    });
+                    break;
+                }
+            }
+        }
+        if (input.url) {
+            try {
+                const url = new URL(input.url);
+                if (url.protocol !== 'https:' && !['localhost', '127.0.0.1', '::1'].includes(url.hostname)) {
+                    findings.push({
+                        type: 'network-risk',
+                        severity: 'medium',
+                        blocked: false,
+                        reason: 'Agent is using a non-HTTPS external URL.',
+                        evidence: input.url,
+                        recommendation: 'Prefer HTTPS or a localhost development target.',
+                    });
+                }
+            }
+            catch {
+                findings.push({
+                    type: 'network-risk',
+                    severity: 'low',
+                    blocked: false,
+                    reason: 'URL could not be parsed for safety checks.',
+                    evidence: input.url,
+                    recommendation: 'Verify the destination manually before allowing the agent to proceed.',
+                });
+            }
+        }
+        if (input.content) {
+            for (const pattern of PROMPT_INJECTION) {
+                if (pattern.test(input.content)) {
+                    findings.push({
+                        type: 'prompt-injection',
+                        severity: 'high',
+                        blocked: true,
+                        reason: 'Content contains prompt-injection language aimed at overriding instructions or leaking data.',
+                        evidence: this.excerpt(input.content),
+                        recommendation: 'Treat this content as untrusted. Summarize it instead of injecting it directly.',
+                    });
+                    break;
+                }
+            }
+            for (const pattern of SECRET_CONTENT) {
+                if (pattern.test(input.content)) {
+                    findings.push({
+                        type: 'secret-access',
+                        severity: 'critical',
+                        blocked: true,
+                        reason: 'Content appears to contain a secret or credential.',
+                        evidence: this.excerpt(input.content),
+                        recommendation: 'Redact secrets before storing, sharing, or injecting this context.',
+                    });
+                    break;
+                }
+            }
+        }
+        const riskScore = findings.reduce((score, finding) => {
+            const weight = finding.severity === 'critical' ? 1 : finding.severity === 'high' ? 0.7 : finding.severity === 'medium' ? 0.4 : 0.15;
+            return Math.max(score, weight);
+        }, 0);
+        const allowed = !findings.some(f => f.blocked);
+        return {
+            allowed,
+            riskScore,
+            findings,
+            summary: findings.length
+                ? `${findings.filter(f => f.blocked).length} blocked, ${findings.length} finding(s), risk ${(riskScore * 100).toFixed(0)}%`
+                : 'Allowed: no firewall findings',
+        };
+    }
+    formatClaudeHookDecision(decision) {
+        if (decision.allowed)
+            return '';
+        return JSON.stringify({
+            hookSpecificOutput: {
+                hookEventName: 'PreToolUse',
+                permissionDecision: 'deny',
+                permissionDecisionReason: decision.summary,
+            },
+        });
+    }
+    excerpt(content) {
+        return content.replace(/\s+/g, ' ').slice(0, 180);
+    }
+}
+//# sourceMappingURL=agent-firewall.js.map

package/dist/brain/agent-firewall.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-firewall.js","sourceRoot":"","sources":["../../src/brain/agent-firewall.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAI9E,MAAM,WAAW,GAAG,kGAAkG,CAAC;AACvH,MAAM,oBAAoB,GAAG;IAC3B,kDAAkD;IAClD,2BAA2B;IAC3B,yBAAyB;IACzB,+BAA+B;IAC/B,4BAA4B;IAC5B,uBAAuB;CACxB,CAAC;AACF,MAAM,aAAa,GAAG;IACpB,wDAAwD;IACxD,8DAA8D;IAC9D,sCAAsC;IACtC,2CAA2C;CAC5C,CAAC;AACF,MAAM,gBAAgB,GAAG;IACvB,mEAAmE;IACnE,0EAA0E;IAC1E,iEAAiE;IACjE,kDAAkD;CACnD,CAAC;AACF,MAAM,cAAc,GAAG;IACrB,8EAA8E;IAC9E,oFAAoF;IACpF,yDAAyD;IACzD,iCAAiC;CAClC,CAAC;AAEF,MAAM,OAAO,aAAa;IACxB,KAAK,CAAC,KAAyB;QAC7B,MAAM,QAAQ,GAAsB,EAAE,CAAC;QAEvC,IAAI,KAAK,CAAC,QAAQ,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,eAAe;gBACrB,QAAQ,EAAE,UAAU;gBACpB,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,wDAAwD;gBAChE,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,cAAc,EAAE,8EAA8E;aAC/F,CAAC,CAAC;QACL,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,KAAK,MAAM,OAAO,IAAI,oBAAoB,EAAE,CAAC;gBAC3C,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;oBAChC,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,qBAAqB;wBAC3B,QAAQ,EAAE,UAAU;wBACpB,OAAO,EAAE,IAAI;wBACb,MAAM,EAAE,8CAA8C;wBACtD,QAAQ,EAAE,KAAK,CAAC,OAAO;wBACvB,cAAc,EAAE,yEAAyE;qBAC1F,CAAC,CAAC;oBACH,MAAM;gBACR,CAAC;YACH,CAAC;YAED,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;gBACpC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;oBAChC,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,cAAc;wBACpB,QAAQ,EAAE,MAAM;wBAChB,OAAO,EAAE,IAAI;wBACb,MAAM,EAAE,kFAAkF;wBAC1F,QAAQ,EAAE,KAAK,CAAC,OAAO;wBACvB,cAAc,EAAE,+EAA+E;qBAChG,CAAC,CAAC;oBACH,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;YACd,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC/B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC3F,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,cAAc;wBACpB,QAAQ,EAAE,QAAQ;wBAClB,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,0CAA0C;wBAClD,QAAQ,EAAE,KAAK,CAAC,GAAG;wBACnB,cAAc,EAAE,iDAAiD;qBAClE,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,cAAc;oBACpB,QAAQ,EAAE,KAAK;oBACf,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,4CAA4C;oBACpD,QAAQ,EAAE,KAAK,CAAC,GAAG;oBACnB,cAAc,EAAE,uEAAuE;iBACxF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;gBACvC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;oBAChC,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,kBAAkB;wBACxB,QAAQ,EAAE,MAAM;wBAChB,OAAO,EAAE,IAAI;wBACb,MAAM,EAAE,8FAA8F;wBACtG,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;wBACrC,cAAc,EAAE,iFAAiF;qBAClG,CAAC,CAAC;oBACH,MAAM;gBACR,CAAC;YACH,CAAC;YAED,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;gBACrC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;oBAChC,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,eAAe;wBACrB,QAAQ,EAAE,UAAU;wBACpB,OAAO,EAAE,IAAI;wBACb,MAAM,EAAE,oDAAoD;wBAC5D,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;wBACrC,cAAc,EAAE,oEAAoE;qBACrF,CAAC,CAAC;oBACH,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YACnD,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YACpI,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACjC,CAAC,EAAE,CAAC,CAAC,CAAC;QAEN,MAAM,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC/C,OAAO;YACL,OAAO;YACP,SAAS;YACT,QAAQ;YACR,OAAO,EAAE,QAAQ,CAAC,MAAM;gBACtB,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,aAAa,QAAQ,CAAC,MAAM,qBAAqB,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG;gBAC3H,CAAC,CAAC,+BAA+B;SACpC,CAAC;IACJ,CAAC;IAED,wBAAwB,CAAC,QAA0B;QACjD,IAAI,QAAQ,CAAC,OAAO;YAAE,OAAO,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC,SAAS,CAAC;YACpB,kBAAkB,EAAE;gBAClB,aAAa,EAAE,YAAY;gBAC3B,kBAAkB,EAAE,MAAM;gBAC1B,wBAAwB,EAAE,QAAQ,CAAC,OAAO;aAC3C;SACF,CAAC,CAAC;IACL,CAAC;IAEO,OAAO,CAAC,OAAe;QAC7B,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC;CACF"}

package/dist/brain/agent-handoff.d.ts

@@ -0,0 +1,19 @@
+import { AgentHandoffPacket, AgentTool } from '../types.js';
+import { GlobalBrain } from './global-brain.js';
+export declare class AgentHandoff {
+    private brain;
+    private firewall;
+    constructor(brain?: GlobalBrain);
+    generate(opts: {
+        fromAgent: AgentTool;
+        toAgent: AgentTool;
+        projectDir: string;
+        task?: string;
+        limit?: number;
+    }): Promise<AgentHandoffPacket>;
+    private getChangedFiles;
+    private getGitSummary;
+    private getSafetyWarnings;
+    private toMarkdown;
+}
+//# sourceMappingURL=agent-handoff.d.ts.map

package/dist/brain/agent-handoff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-handoff.d.ts","sourceRoot":"","sources":["../../src/brain/agent-handoff.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAsB,MAAM,aAAa,CAAC;AAChF,OAAO,EAAE,WAAW,EAAkB,MAAM,mBAAmB,CAAC;AAGhE,qBAAa,YAAY;IACvB,OAAO,CAAC,KAAK,CAAc;IAC3B,OAAO,CAAC,QAAQ,CAAuB;gBAE3B,KAAK,cAAmB;IAI9B,QAAQ,CAAC,IAAI,EAAE;QACnB,SAAS,EAAE,SAAS,CAAC;QACrB,OAAO,EAAE,SAAS,CAAC;QACnB,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,kBAAkB,CAAC;YAmCjB,eAAe;YAef,aAAa;IAgB3B,OAAO,CAAC,iBAAiB;IAazB,OAAO,CAAC,UAAU;CA+CnB"}

package/dist/brain/agent-handoff.js

@@ -0,0 +1,127 @@
+// src/brain/agent-handoff.ts — Cross-agent continuation packets
+import * as path from 'path';
+import { GlobalBrain, getGlobalBrain } from './global-brain.js';
+import { AgentFirewall } from './agent-firewall.js';
+export class AgentHandoff {
+    constructor(brain = getGlobalBrain()) {
+        this.firewall = new AgentFirewall();
+        this.brain = brain;
+    }
+    async generate(opts) {
+        await this.brain.init();
+        const projectDir = path.resolve(opts.projectDir);
+        const projectId = GlobalBrain.projectIdFor(projectDir);
+        const projectName = path.basename(projectDir);
+        const recentMemories = this.brain.timeline({
+            projectId,
+            limit: opts.limit ?? 12,
+        });
+        const changedFiles = await this.getChangedFiles(projectDir);
+        const gitSummary = await this.getGitSummary(projectDir);
+        const safetyWarnings = this.getSafetyWarnings(recentMemories, changedFiles);
+        const task = opts.task || 'Continue the current implementation with the project conventions and warnings below.';
+        const packet = {
+            fromAgent: opts.fromAgent,
+            toAgent: opts.toAgent,
+            projectDir,
+            projectName,
+            task,
+            createdAt: new Date(),
+            recentMemories,
+            changedFiles,
+            gitSummary,
+            safetyWarnings,
+        };
+        return {
+            ...packet,
+            markdown: this.toMarkdown(packet),
+        };
+    }
+    async getChangedFiles(projectDir) {
+        try {
+            const { execa } = await import('execa');
+            const { stdout } = await execa('git', ['status', '--short'], { cwd: projectDir, reject: false });
+            return stdout
+                .split('\n')
+                .map(line => line.trim())
+                .filter(Boolean)
+                .map(line => line.replace(/^..?\s+/, '').replace(/^"|"$/g, ''))
+                .slice(0, 40);
+        }
+        catch {
+            return [];
+        }
+    }
+    async getGitSummary(projectDir) {
+        try {
+            const { execa } = await import('execa');
+            const [branch, diff] = await Promise.all([
+                execa('git', ['branch', '--show-current'], { cwd: projectDir, reject: false }),
+                execa('git', ['diff', '--stat'], { cwd: projectDir, reject: false }),
+            ]);
+            return [
+                branch.stdout ? `Branch: ${branch.stdout}` : 'Branch: unknown',
+                diff.stdout || 'No unstaged diff stat available',
+            ].join('\n');
+        }
+        catch {
+            return 'Git summary unavailable.';
+        }
+    }
+    getSafetyWarnings(memories, changedFiles) {
+        const warnings = new Set();
+        for (const file of changedFiles) {
+            const decision = this.firewall.check({ filePath: file });
+            for (const finding of decision.findings)
+                warnings.add(finding.reason);
+        }
+        for (const event of memories) {
+            const decision = this.firewall.check({ content: event.content });
+            for (const finding of decision.findings)
+                warnings.add(finding.reason);
+        }
+        return Array.from(warnings).slice(0, 8);
+    }
+    toMarkdown(packet) {
+        const lines = [
+            `# Shadow Brain Agent Handoff`,
+            ``,
+            `**From:** ${packet.fromAgent}`,
+            `**To:** ${packet.toAgent}`,
+            `**Project:** ${packet.projectName}`,
+            `**Created:** ${packet.createdAt.toISOString()}`,
+            ``,
+            `## Current Task`,
+            packet.task,
+            ``,
+            `## Git State`,
+            '```text',
+            packet.gitSummary,
+            '```',
+            ``,
+            `## Changed Files`,
+            ...(packet.changedFiles.length ? packet.changedFiles.map(f => `- ${f}`) : ['- No changed files detected']),
+            ``,
+            `## Recent Shared Memory`,
+        ];
+        if (packet.recentMemories.length) {
+            for (const memory of packet.recentMemories) {
+                lines.push(`- [${memory.agentTool}/${memory.category}] ${memory.content.slice(0, 220)}`);
+            }
+        }
+        else {
+            lines.push('- No global memories yet. Start by recording decisions and warnings.');
+        }
+        lines.push('', '## Safety Warnings');
+        if (packet.safetyWarnings.length) {
+            for (const warning of packet.safetyWarnings)
+                lines.push(`- ${warning}`);
+        }
+        else {
+            lines.push('- No safety warnings detected in the handoff packet.');
+        }
+        lines.push('', '## Instruction For Receiving Agent', 'Continue from this packet. Prefer project-specific memory over generic assumptions. Do not access secrets or run destructive commands without explicit user approval.', '');
+        return lines.join('\n');
+    }
+}
+//# sourceMappingURL=agent-handoff.js.map

package/dist/brain/agent-handoff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-handoff.js","sourceRoot":"","sources":["../../src/brain/agent-handoff.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAEhE,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,MAAM,OAAO,YAAY;IAIvB,YAAY,KAAK,GAAG,cAAc,EAAE;QAF5B,aAAQ,GAAG,IAAI,aAAa,EAAE,CAAC;QAGrC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAMd;QACC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAExB,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjD,MAAM,SAAS,GAAG,WAAW,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QACvD,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC9C,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;YACzC,SAAS;YACT,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;SACxB,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QAC5D,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QACxD,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;QAC5E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,sFAAsF,CAAC;QAEjH,MAAM,MAAM,GAAyC;YACnD,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,UAAU;YACV,WAAW;YACX,IAAI;YACJ,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,cAAc;YACd,YAAY;YACZ,UAAU;YACV,cAAc;SACf,CAAC;QAEF,OAAO;YACL,GAAG,MAAM;YACT,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;SAClC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,UAAkB;QAC9C,IAAI,CAAC;YACH,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;YACxC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACjG,OAAO,MAAM;iBACV,KAAK,CAAC,IAAI,CAAC;iBACX,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;iBACxB,MAAM,CAAC,OAAO,CAAC;iBACf,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;iBAC9D,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,UAAkB;QAC5C,IAAI,CAAC;YACH,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;YACxC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACvC,KAAK,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,gBAAgB,CAAC,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;gBAC9E,KAAK,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;aACrE,CAAC,CAAC;YACH,OAAO;gBACL,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,iBAAiB;gBAC9D,IAAI,CAAC,MAAM,IAAI,iCAAiC;aACjD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,0BAA0B,CAAC;QACpC,CAAC;IACH,CAAC;IAEO,iBAAiB,CAAC,QAA8B,EAAE,YAAsB;QAC9E,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YACzD,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,QAAQ;gBAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACxE,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;YAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACjE,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,QAAQ;gBAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1C,CAAC;IAEO,UAAU,CAAC,MAA4C;QAC7D,MAAM,KAAK,GAAa;YACtB,8BAA8B;YAC9B,EAAE;YACF,aAAa,MAAM,CAAC,SAAS,EAAE;YAC/B,WAAW,MAAM,CAAC,OAAO,EAAE;YAC3B,gBAAgB,MAAM,CAAC,WAAW,EAAE;YACpC,gBAAgB,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE;YAChD,EAAE;YACF,iBAAiB;YACjB,MAAM,CAAC,IAAI;YACX,EAAE;YACF,cAAc;YACd,SAAS;YACT,MAAM,CAAC,UAAU;YACjB,KAAK;YACL,EAAE;YACF,kBAAkB;YAClB,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC;YAC1G,EAAE;YACF,yBAAyB;SAC1B,CAAC;QAEF,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC;YACjC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;gBAC3C,KAAK,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YAC3F,CAAC;QACH,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,sEAAsE,CAAC,CAAC;QACrF,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,oBAAoB,CAAC,CAAC;QACrC,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC;YACjC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,cAAc;gBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC;QAC1E,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;QACrE,CAAC;QAED,KAAK,CAAC,IAAI,CACR,EAAE,EACF,oCAAoC,EACpC,uKAAuK,EACvK,EAAE,CACH,CAAC;QAEF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;CACF"}

package/dist/brain/air-gap.d.ts

@@ -0,0 +1,23 @@
+import { AirGapStatus } from '../types.js';
+export declare class AirGapMode {
+    private enabled;
+    private policy;
+    private blockedOutbound;
+    private allowedLocal;
+    private lastAttempt;
+    private initialized;
+    init(): Promise<void>;
+    enable(policy?: 'strict' | 'loose'): Promise<void>;
+    disable(): Promise<void>;
+    isEnabled(): boolean;
+    /**
+     * Check if a URL is allowed. Call this before any fetch/http from Shadow Brain.
+     * Returns false if air-gap is on and the URL is not localhost.
+     */
+    gate(url: string): Promise<boolean>;
+    status(): AirGapStatus;
+    private persist;
+}
+export declare function getAirGapMode(): AirGapMode;
+export declare function resetAirGapModeForTests(): void;
+//# sourceMappingURL=air-gap.d.ts.map

package/dist/brain/air-gap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"air-gap.d.ts","sourceRoot":"","sources":["../../src/brain/air-gap.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAa3C,qBAAa,UAAU;IACrB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAAgC;IAC9C,OAAO,CAAC,eAAe,CAAK;IAC5B,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,WAAW,CAAqB;IACxC,OAAO,CAAC,WAAW,CAAS;IAEtB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAmBrB,MAAM,CAAC,MAAM,GAAE,QAAQ,GAAG,OAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ5D,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAO9B,SAAS,IAAI,OAAO;IAIpB;;;OAGG;IACG,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAyCzC,MAAM,IAAI,YAAY;YAUR,OAAO;CAiBtB;AAID,wBAAgB,aAAa,IAAI,UAAU,CAG1C;AAED,wBAAgB,uBAAuB,IAAI,IAAI,CAE9C"}

package/dist/brain/air-gap.js

@@ -0,0 +1,137 @@
+// src/brain/air-gap.ts — Air-Gap Mode
+// v6.0.0 — Hive Mind Edition
+//
+// Opt-in strict mode: block all outbound network from Shadow Brain. Only
+// localhost targets (Ollama, dashboard) are allowed. Enterprise/government
+// friendly — "the brain never leaves this machine."
+import * as fs from 'fs';
+import * as path from 'path';
+import * as os from 'os';
+const STATUS_PATH = path.join(os.homedir(), '.shadow-brain', 'air-gap.json');
+export class AirGapMode {
+    constructor() {
+        this.enabled = false;
+        this.policy = 'strict';
+        this.blockedOutbound = 0;
+        this.allowedLocal = 0;
+        this.lastAttempt = null;
+        this.initialized = false;
+    }
+    async init() {
+        if (this.initialized)
+            return;
+        fs.mkdirSync(path.dirname(STATUS_PATH), { recursive: true });
+        if (fs.existsSync(STATUS_PATH)) {
+            try {
+                const parsed = JSON.parse(fs.readFileSync(STATUS_PATH, 'utf-8'));
+                this.enabled = parsed.enabled ?? false;
+                this.policy = parsed.policy ?? 'strict';
+                this.blockedOutbound = parsed.blockedOutboundCount ?? 0;
+                this.allowedLocal = parsed.allowedLocalCount ?? 0;
+                this.lastAttempt = parsed.lastAttempt ? new Date(parsed.lastAttempt) : null;
+            }
+            catch {
+                /* skip */
+            }
+        }
+        if (this.enabled)
+            process.env.SHADOW_BRAIN_AIR_GAP = '1';
+        this.initialized = true;
+    }
+    async enable(policy = 'strict') {
+        await this.init();
+        this.enabled = true;
+        this.policy = policy;
+        process.env.SHADOW_BRAIN_AIR_GAP = '1';
+        await this.persist();
+    }
+    async disable() {
+        await this.init();
+        this.enabled = false;
+        delete process.env.SHADOW_BRAIN_AIR_GAP;
+        await this.persist();
+    }
+    isEnabled() {
+        return this.enabled;
+    }
+    /**
+     * Check if a URL is allowed. Call this before any fetch/http from Shadow Brain.
+     * Returns false if air-gap is on and the URL is not localhost.
+     */
+    async gate(url) {
+        await this.init();
+        this.lastAttempt = new Date();
+        if (!this.enabled) {
+            this.allowedLocal++;
+            await this.persist();
+            return true;
+        }
+        try {
+            const u = new URL(url);
+            const host = u.hostname;
+            const isLocal = host === 'localhost'
+                || host === '127.0.0.1'
+                || host === '::1'
+                || host === '0.0.0.0'
+                || /^10\./.test(host)
+                || /^192\.168\./.test(host)
+                || /^172\.(1[6-9]|2\d|3[01])\./.test(host);
+            // Strict policy: refuse RFC1918 private ranges too (they may leave network)
+            if (this.policy === 'strict' && !['localhost', '127.0.0.1', '::1'].includes(host)) {
+                this.blockedOutbound++;
+                await this.persist();
+                return false;
+            }
+            if (!isLocal) {
+                this.blockedOutbound++;
+                await this.persist();
+                return false;
+            }
+            this.allowedLocal++;
+            await this.persist();
+            return true;
+        }
+        catch {
+            this.blockedOutbound++;
+            await this.persist();
+            return false;
+        }
+    }
+    status() {
+        return {
+            enabled: this.enabled,
+            blockedOutboundCount: this.blockedOutbound,
+            allowedLocalCount: this.allowedLocal,
+            lastAttempt: this.lastAttempt,
+            policy: this.policy,
+        };
+    }
+    async persist() {
+        try {
+            const payload = {
+                schemaVersion: 1,
+                enabled: this.enabled,
+                policy: this.policy,
+                blockedOutboundCount: this.blockedOutbound,
+                allowedLocalCount: this.allowedLocal,
+                lastAttempt: this.lastAttempt ? this.lastAttempt.toISOString() : null,
+            };
+            const tmp = STATUS_PATH + '.tmp';
+            fs.writeFileSync(tmp, JSON.stringify(payload, null, 2));
+            fs.renameSync(tmp, STATUS_PATH);
+        }
+        catch {
+            /* non-fatal */
+        }
+    }
+}
+let _instance = null;
+export function getAirGapMode() {
+    if (!_instance)
+        _instance = new AirGapMode();
+    return _instance;
+}
+export function resetAirGapModeForTests() {
+    _instance = null;
+}
+//# sourceMappingURL=air-gap.js.map

package/dist/brain/air-gap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"air-gap.js","sourceRoot":"","sources":["../../src/brain/air-gap.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,6BAA6B;AAC7B,EAAE;AACF,yEAAyE;AACzE,2EAA2E;AAC3E,oDAAoD;AAEpD,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AAGzB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,eAAe,EAAE,cAAc,CAAC,CAAC;AAW7E,MAAM,OAAO,UAAU;IAAvB;QACU,YAAO,GAAG,KAAK,CAAC;QAChB,WAAM,GAAuB,QAAQ,CAAC;QACtC,oBAAe,GAAG,CAAC,CAAC;QACpB,iBAAY,GAAG,CAAC,CAAC;QACjB,gBAAW,GAAgB,IAAI,CAAC;QAChC,gBAAW,GAAG,KAAK,CAAC;IAgH9B,CAAC;IA9GC,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO;QAC7B,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAiB,CAAC;gBACjF,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC;gBACvC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,QAAQ,CAAC;gBACxC,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,oBAAoB,IAAI,CAAC,CAAC;gBACxD,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,iBAAiB,IAAI,CAAC,CAAC;gBAClD,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC9E,CAAC;YAAC,MAAM,CAAC;gBACP,UAAU;YACZ,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,GAAG,CAAC;QACzD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAA6B,QAAQ;QAChD,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,GAAG,CAAC;QACvC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACrB,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;QACxC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IACvB,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,GAAW;QACpB,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,IAAI,CAAC,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YACvB,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC;YACxB,MAAM,OAAO,GACX,IAAI,KAAK,WAAW;mBACjB,IAAI,KAAK,WAAW;mBACpB,IAAI,KAAK,KAAK;mBACd,IAAI,KAAK,SAAS;mBAClB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;mBAClB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;mBACxB,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAE7C,4EAA4E;YAC5E,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClF,IAAI,CAAC,eAAe,EAAE,CAAC;gBACvB,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;gBACrB,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,IAAI,CAAC,eAAe,EAAE,CAAC;gBACvB,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;gBACrB,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,eAAe,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,MAAM;QACJ,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,oBAAoB,EAAE,IAAI,CAAC,eAAe;YAC1C,iBAAiB,EAAE,IAAI,CAAC,YAAY;YACpC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,OAAO;QACnB,IAAI,CAAC;YACH,MAAM,OAAO,GAAiB;gBAC5B,aAAa,EAAE,CAAC;gBAChB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,oBAAoB,EAAE,IAAI,CAAC,eAAe;gBAC1C,iBAAiB,EAAE,IAAI,CAAC,YAAY;gBACpC,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;aACtE,CAAC;YACF,MAAM,GAAG,GAAG,WAAW,GAAG,MAAM,CAAC;YACjC,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACxD,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;IACH,CAAC;CACF;AAED,IAAI,SAAS,GAAsB,IAAI,CAAC;AAExC,MAAM,UAAU,aAAa;IAC3B,IAAI,CAAC,SAAS;QAAE,SAAS,GAAG,IAAI,UAAU,EAAE,CAAC;IAC7C,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,uBAAuB;IACrC,SAAS,GAAG,IAAI,CAAC;AACnB,CAAC"}

package/dist/brain/attention-heatmap.d.ts

@@ -0,0 +1,24 @@
+import { AttentionReport, AgentTool } from '../types.js';
+export declare class AttentionHeatmap {
+    private brain;
+    constructor();
+    /**
+     * Compute attention for a given decision. Inputs:
+     *   - decisionText: the AI output we're attributing
+     *   - candidateMemoryIds: memories that were visible to the agent
+     */
+    compute(opts: {
+        decisionText: string;
+        candidateMemoryIds: string[];
+        agentTool: AgentTool;
+    }): Promise<AttentionReport>;
+    /** Text-based heatmap rendered as a simple ASCII bar chart. */
+    renderText(report: AttentionReport): string;
+    private genId;
+    private similarity;
+    private tokenSet;
+    private explain;
+}
+export declare function getAttentionHeatmap(): AttentionHeatmap;
+export declare function resetAttentionHeatmapForTests(): void;
+//# sourceMappingURL=attention-heatmap.d.ts.map

package/dist/brain/attention-heatmap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attention-heatmap.d.ts","sourceRoot":"","sources":["../../src/brain/attention-heatmap.ts"],"names":[],"mappings":"AAWA,OAAO,EACL,eAAe,EAEf,SAAS,EAEV,MAAM,aAAa,CAAC;AAGrB,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,KAAK,CAAc;;IAM3B;;;;OAIG;IACG,OAAO,CAAC,IAAI,EAAE;QAClB,YAAY,EAAE,MAAM,CAAC;QACrB,kBAAkB,EAAE,MAAM,EAAE,CAAC;QAC7B,SAAS,EAAE,SAAS,CAAC;KACtB,GAAG,OAAO,CAAC,eAAe,CAAC;IAwC5B,+DAA+D;IAC/D,UAAU,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM;IAgB3C,OAAO,CAAC,KAAK;IAIb,OAAO,CAAC,UAAU;IAWlB,OAAO,CAAC,QAAQ;IAUhB,OAAO,CAAC,OAAO;CAGhB;AAID,wBAAgB,mBAAmB,IAAI,gBAAgB,CAGtD;AAED,wBAAgB,6BAA6B,IAAI,IAAI,CAEpD"}

package/dist/brain/attention-heatmap.js

@@ -0,0 +1,108 @@
+// src/brain/attention-heatmap.ts — Mechanistic interpretability for brain decisions
+// v6.0.0 — Hive Mind Edition
+//
+// After any AI decision is made with brain input, show which memories influenced
+// the output, with weighted attribution.
+//
+// Not a gradient-based attention (we don't have the model internals) — instead
+// it's a RETRIEVAL-WEIGHTED attribution that approximates mechanistic attention
+// via semantic similarity + explicit citation tracking.
+import * as crypto from 'crypto';
+import { getGlobalBrain } from './global-brain.js';
+export class AttentionHeatmap {
+    constructor() {
+        this.brain = getGlobalBrain();
+    }
+    /**
+     * Compute attention for a given decision. Inputs:
+     *   - decisionText: the AI output we're attributing
+     *   - candidateMemoryIds: memories that were visible to the agent
+     */
+    async compute(opts) {
+        await this.brain.init();
+        const candidates = this.brain.recallByIds(opts.candidateMemoryIds);
+        if (!candidates.length) {
+            return {
+                decisionId: this.genId(opts.decisionText),
+                decisionText: opts.decisionText,
+                agentTool: opts.agentTool,
+                weights: [],
+                totalMemoriesConsidered: 0,
+                generatedAt: new Date(),
+            };
+        }
+        const rawWeights = candidates.map(mem => ({
+            mem,
+            raw: this.similarity(opts.decisionText, mem.content) + mem.importance * 0.5,
+        }));
+        const total = rawWeights.reduce((sum, w) => sum + w.raw, 0) || 1;
+        const weights = rawWeights
+            .map(({ mem, raw }) => ({
+            memoryId: mem.id,
+            memoryContent: mem.content.slice(0, 160),
+            weight: +(raw / total).toFixed(4),
+            category: mem.category,
+            reasoning: this.explain(opts.decisionText, mem),
+        }))
+            .sort((a, b) => b.weight - a.weight);
+        return {
+            decisionId: this.genId(opts.decisionText),
+            decisionText: opts.decisionText,
+            agentTool: opts.agentTool,
+            weights,
+            totalMemoriesConsidered: candidates.length,
+            generatedAt: new Date(),
+        };
+    }
+    /** Text-based heatmap rendered as a simple ASCII bar chart. */
+    renderText(report) {
+        const lines = [
+            `Decision: ${report.decisionText.slice(0, 120)}`,
+            `Agent: ${report.agentTool} · Memories considered: ${report.totalMemoriesConsidered}`,
+            ``,
+        ];
+        const top = report.weights.slice(0, 8);
+        for (const w of top) {
+            const bar = '█'.repeat(Math.min(30, Math.round(w.weight * 50)));
+            lines.push(`${(w.weight * 100).toFixed(1).padStart(5)}% ${bar} [${w.category}] ${w.memoryContent.slice(0, 60)}`);
+        }
+        return lines.join('\n');
+    }
+    // ── Internals ─────────────────────────────────────────────────────────────
+    genId(text) {
+        return 'dec-' + crypto.createHash('sha1').update(text).digest('hex').slice(0, 12);
+    }
+    similarity(a, b) {
+        // Token-set Jaccard (fast, no embedding deps)
+        const setA = this.tokenSet(a);
+        const setB = this.tokenSet(b);
+        if (!setA.size || !setB.size)
+            return 0.01;
+        let intersect = 0;
+        for (const t of setA)
+            if (setB.has(t))
+                intersect++;
+        const union = setA.size + setB.size - intersect;
+        return union ? intersect / union : 0;
+    }
+    tokenSet(s) {
+        const stopwords = new Set(['the', 'a', 'an', 'and', 'or', 'of', 'to', 'in', 'on', 'is', 'it', 'this', 'that']);
+        return new Set(s.toLowerCase()
+            .replace(/[^a-z0-9\s-]/g, ' ')
+            .split(/\s+/)
+            .filter(t => t.length > 2 && !stopwords.has(t)));
+    }
+    explain(_decision, mem) {
+        return `${mem.category} · importance ${Math.round(mem.importance * 100)}%`;
+    }
+}
+let _instance = null;
+export function getAttentionHeatmap() {
+    if (!_instance)
+        _instance = new AttentionHeatmap();
+    return _instance;
+}
+export function resetAttentionHeatmapForTests() {
+    _instance = null;
+}
+//# sourceMappingURL=attention-heatmap.js.map

package/dist/brain/attention-heatmap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attention-heatmap.js","sourceRoot":"","sources":["../../src/brain/attention-heatmap.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,6BAA6B;AAC7B,EAAE;AACF,iFAAiF;AACjF,yCAAyC;AACzC,EAAE;AACF,+EAA+E;AAC/E,gFAAgF;AAChF,wDAAwD;AAExD,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AAOjC,OAAO,EAAE,cAAc,EAAe,MAAM,mBAAmB,CAAC;AAEhE,MAAM,OAAO,gBAAgB;IAG3B;QACE,IAAI,CAAC,KAAK,GAAG,cAAc,EAAE,CAAC;IAChC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAC,IAIb;QACC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACxB,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACnE,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YACvB,OAAO;gBACL,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC;gBACzC,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,OAAO,EAAE,EAAE;gBACX,uBAAuB,EAAE,CAAC;gBAC1B,WAAW,EAAE,IAAI,IAAI,EAAE;aACxB,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACxC,GAAG;YACH,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC,UAAU,GAAG,GAAG;SAC5E,CAAC,CAAC,CAAC;QAEJ,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACjE,MAAM,OAAO,GAAsB,UAAU;aAC1C,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;YACtB,QAAQ,EAAE,GAAG,CAAC,EAAE;YAChB,aAAa,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;YACxC,MAAM,EAAE,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;YACjC,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC;SAChD,CAAC,CAAC;aACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;QAEvC,OAAO;YACL,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC;YACzC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO;YACP,uBAAuB,EAAE,UAAU,CAAC,MAAM;YAC1C,WAAW,EAAE,IAAI,IAAI,EAAE;SACxB,CAAC;IACJ,CAAC;IAED,+DAA+D;IAC/D,UAAU,CAAC,MAAuB;QAChC,MAAM,KAAK,GAAa;YACtB,aAAa,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YAChD,UAAU,MAAM,CAAC,SAAS,2BAA2B,MAAM,CAAC,uBAAuB,EAAE;YACrF,EAAE;SACH,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACvC,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACpB,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;YAChE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;QACnH,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,6EAA6E;IAErE,KAAK,CAAC,IAAY;QACxB,OAAO,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACpF,CAAC;IAEO,UAAU,CAAC,CAAS,EAAE,CAAS;QACrC,8CAA8C;QAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAC1C,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,SAAS,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC;QAChD,OAAO,KAAK,CAAC,CAAC,CAAC,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC;IAEO,QAAQ,CAAC,CAAS;QACxB,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QAC/G,OAAO,IAAI,GAAG,CACZ,CAAC,CAAC,WAAW,EAAE;aACZ,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC;aAC7B,KAAK,CAAC,KAAK,CAAC;aACZ,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAClD,CAAC;IACJ,CAAC;IAEO,OAAO,CAAC,SAAiB,EAAE,GAAgB;QACjD,OAAO,GAAG,GAAG,CAAC,QAAQ,iBAAiB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,GAAG,CAAC;IAC7E,CAAC;CACF;AAED,IAAI,SAAS,GAA4B,IAAI,CAAC;AAE9C,MAAM,UAAU,mBAAmB;IACjC,IAAI,CAAC,SAAS;QAAE,SAAS,GAAG,IAAI,gBAAgB,EAAE,CAAC;IACnD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,6BAA6B;IAC3C,SAAS,GAAG,IAAI,CAAC;AACnB,CAAC"}